You may have more luck with the POSIX character class [[:space:]] rather than shorthand \s.
-- Noel Jones On 2/18/2016 5:22 PM, Dennis Peterson wrote: > ^New\ Doc.* (<- that is from the below example but is actually a > poorly constructed regex because it will search to end of > line/string) should work to escape the space char but that is one of > the oddities of regex - knowing which implementation is being used. > > dp > > On 2/18/16 3:13 PM, Steven Morgan wrote: >> >> Looks like ClamAV uses what is called the "old library." I don't >> think this >> is POSIX compliant with regard to regular expressions. >> >> Hope this helps, >> Steve >> >> On Thu, Feb 18, 2016 at 3:12 PM, Mehmet Avcioglu >> <meh...@activecom.net> >> wrote: >> >>>> On Feb 18, 2016, at 8:14 PM, Steven Morgan <smor...@sourcefire.com> >>> wrote: >>>> cdb signatures use a regex library known as "Henry Spencer's >>>> regular >>>> expressions." Googling documentation for that should give what >>>> you want. >>> Thank you for the information. I searched out for that and found >>> documentation, but am not able to get the desired outcome. Henry >>> Spencer’s >>> regular expressions are supposed to be POSIX compliment and "\s" >>> is valid >>> for space but I cannot get it to work. >>> >>> For example I am able to use "^New.Doc.*" to match for "New >>> Doc.xls" but >>> "^New\sDoc.*" or "^New Doc.*" does not. >>> >>> Thanks >>> >>> -- >>> Mehmet Avcioglu >>> meh...@activecom.net >>> >>> _______________________________________________ >>> Help us build a comprehensive ClamAV guide: >>> https://github.com/vrtadmin/clamav-faq >>> >>> http://www.clamav.net/contact.html#ml >>> >> _______________________________________________ >> Help us build a comprehensive ClamAV guide: >> https://github.com/vrtadmin/clamav-faq >> >> http://www.clamav.net/contact.html#ml > > _______________________________________________ > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > > http://www.clamav.net/contact.html#ml _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
